)]}'
{"bandit.yaml":[{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"4e6b2dd8be89fd8f5549df0a6e52a757e2345cee","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        include:"},{"line_number":34,"context_line":"            - execute_with_run_as_root_equals_true"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"    SecretConfigOpt:"},{"line_number":37,"context_line":"        include:"},{"line_number":38,"context_line":"            - password_config_option_not_marked_secret"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"ba7be1f8_8858738b","line":36,"updated":"2015-02-25 02:16:32.000000000","message":"I would probably change this profile to something generic about passwords instead of specific label.","commit_id":"c00403e912b526377e0cbca76ca0d29361a93a41"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4f25a2b45408728cbab87e44d67c27f7b1f5c90c","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        include:"},{"line_number":34,"context_line":"            - execute_with_run_as_root_equals_true"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"    SecretConfigOpt:"},{"line_number":37,"context_line":"        include:"},{"line_number":38,"context_line":"            - password_config_option_not_marked_secret"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"ba7be1f8_d1484f5e","line":36,"in_reply_to":"ba7be1f8_8858738b","updated":"2015-02-25 06:59:05.000000000","message":"Done","commit_id":"c00403e912b526377e0cbca76ca0d29361a93a41"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"8be9508ea8d4ba629e14f7809f948370caf8b76b","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"password_config_option_not_marked_secret:"},{"line_number":113,"context_line":"    function_names:"},{"line_number":114,"context_line":"        - oslo.config.cfg.StrOpt"},{"line_number":115,"context_line":"        - oslo_config.cfg.StrOpt"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ba7be1f8_b8e0f7cd","line":114,"updated":"2015-02-25 22:08:07.000000000","message":"Why is this duplicated?","commit_id":"bef5288cfbb34c2e127f9e4aa69ba2a17adaf499"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"84aaafc53ebf55a4ce6fae051bac3fed1ed1f958","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"password_config_option_not_marked_secret:"},{"line_number":113,"context_line":"    function_names:"},{"line_number":114,"context_line":"        - oslo.config.cfg.StrOpt"},{"line_number":115,"context_line":"        - oslo_config.cfg.StrOpt"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ba7be1f8_98dfb3d5","line":114,"in_reply_to":"ba7be1f8_b8e0f7cd","updated":"2015-02-25 22:13:01.000000000","message":"oslo.config and oslo_config.  Recently there was a cross-project modification to all use of oslo to use the underscore instead of period.  Not sure all projects have made this change yet.  Plus older releases still use \".\".  When importing from oslo you can use either.","commit_id":"bef5288cfbb34c2e127f9e4aa69ba2a17adaf499"}],"bandit/plugins/secret_config_option.py":[{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"4e6b2dd8be89fd8f5549df0a6e52a757e2345cee","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"},{"line_number":27,"context_line":"        if (context.get_call_arg_at_position(0).endswith(\u0027password\u0027) and"},{"line_number":28,"context_line":"                context.check_call_arg_value(\u0027secret\u0027) in (None, False)):"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"            return(bandit.WARN, \u0027oslo config option not marked secret\u003dTrue \u0027"},{"line_number":31,"context_line":"                   \u0027identified, security issue.  %s\u0027 %"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_288ea7d0","line":28,"updated":"2015-02-25 02:16:32.000000000","message":"Bandit doesn\u0027t do great with context right now, but this won\u0027t catch instances of secret\u003dsome_variable. Not sure if we care about that, just an observation.\n\nIt might be appropriate to set a bandit.INFO if \u0027secret\u0027 is present but not set to either None, False, or True.","commit_id":"c00403e912b526377e0cbca76ca0d29361a93a41"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4f25a2b45408728cbab87e44d67c27f7b1f5c90c","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"},{"line_number":27,"context_line":"        if (context.get_call_arg_at_position(0).endswith(\u0027password\u0027) and"},{"line_number":28,"context_line":"                context.check_call_arg_value(\u0027secret\u0027) in (None, False)):"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"            return(bandit.WARN, \u0027oslo config option not marked secret\u003dTrue \u0027"},{"line_number":31,"context_line":"                   \u0027identified, security issue.  %s\u0027 %"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_31ce0b2f","line":28,"in_reply_to":"ba7be1f8_288ea7d0","updated":"2015-02-25 06:59:05.000000000","message":"Done","commit_id":"c00403e912b526377e0cbca76ca0d29361a93a41"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"45644adecd93e2a2276f62a062f52bbe4a4143a7","unresolved":false,"context_lines":[{"line_number":20,"context_line":"def password_config_option_not_marked_secret(context):"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    function_names \u003d ["},{"line_number":23,"context_line":"        \u0027oslo_config.cfg.StrOpt\u0027,"},{"line_number":24,"context_line":"    ]"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_973955f4","line":23,"updated":"2015-02-25 15:20:53.000000000","message":"Do we want to put this in config, rather than hardcoding it?","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"5b4b186b01147196ad1dab16233ffe78fa004bfe","unresolved":false,"context_lines":[{"line_number":20,"context_line":"def password_config_option_not_marked_secret(context):"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    function_names \u003d ["},{"line_number":23,"context_line":"        \u0027oslo_config.cfg.StrOpt\u0027,"},{"line_number":24,"context_line":"    ]"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_8f8779b4","line":23,"in_reply_to":"ba7be1f8_69dec5de","updated":"2015-02-25 16:55:18.000000000","message":"Yep, you can use @takes_config","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"7b932dd54a7f2f7d7d8b86cc6382134b918c2402","unresolved":false,"context_lines":[{"line_number":20,"context_line":"def password_config_option_not_marked_secret(context):"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    function_names \u003d ["},{"line_number":23,"context_line":"        \u0027oslo_config.cfg.StrOpt\u0027,"},{"line_number":24,"context_line":"    ]"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_69dec5de","line":23,"in_reply_to":"ba7be1f8_973955f4","updated":"2015-02-25 16:34:29.000000000","message":"By config, do you mean bandit.yaml?","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"},{"author":{"_account_id":14692,"name":"Lucas Fisher","email":"lucas.fisher@gmail.com","username":"lucas.fisher"},"change_message_id":"28ac135aa644ac7c33512d12c62af693c603fad7","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"},{"line_number":27,"context_line":"        if context.get_call_arg_at_position(0).endswith(\u0027password\u0027):"},{"line_number":28,"context_line":"            if context.check_call_arg_value(\u0027secret\u0027) in (None, \u0027False\u0027):"},{"line_number":29,"context_line":"                return(bandit.WARN, \u0027oslo config option not marked secret\u003dTrue\u0027"},{"line_number":30,"context_line":"                       \u0027 identified, security issue.  %s\u0027 %"},{"line_number":31,"context_line":"                       context.call_args_string)"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_2304f316","line":28,"updated":"2015-02-25 14:16:53.000000000","message":"Not clear why we check if secret is None or False and if it is not True. Maybe a comment to explain the logic. I see this is based on Rob\u0027s comments. This is probably the first place users will go to check why something is triggering.\n\nThis might be cleaner and more reliable if we check secret against bandit.core.constants.FALSE_VALUES in the commit I just submitted.","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"5b4b186b01147196ad1dab16233ffe78fa004bfe","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"},{"line_number":27,"context_line":"        if context.get_call_arg_at_position(0).endswith(\u0027password\u0027):"},{"line_number":28,"context_line":"            if context.check_call_arg_value(\u0027secret\u0027) in (None, \u0027False\u0027):"},{"line_number":29,"context_line":"                return(bandit.WARN, \u0027oslo config option not marked secret\u003dTrue\u0027"},{"line_number":30,"context_line":"                       \u0027 identified, security issue.  %s\u0027 %"},{"line_number":31,"context_line":"                       context.call_args_string)"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_efbf155f","line":28,"in_reply_to":"ba7be1f8_142d5c95","updated":"2015-02-25 16:55:18.000000000","message":"Actually, shouldn\u0027t we add the string \"False\" to FALSE_VALUES?","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"7b932dd54a7f2f7d7d8b86cc6382134b918c2402","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"},{"line_number":27,"context_line":"        if context.get_call_arg_at_position(0).endswith(\u0027password\u0027):"},{"line_number":28,"context_line":"            if context.check_call_arg_value(\u0027secret\u0027) in (None, \u0027False\u0027):"},{"line_number":29,"context_line":"                return(bandit.WARN, \u0027oslo config option not marked secret\u003dTrue\u0027"},{"line_number":30,"context_line":"                       \u0027 identified, security issue.  %s\u0027 %"},{"line_number":31,"context_line":"                       context.call_args_string)"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_142d5c95","line":28,"in_reply_to":"ba7be1f8_2304f316","updated":"2015-02-25 16:34:29.000000000","message":"This conditional checks whether secret\u003dFalse or secret is not set (None).\n\nI can\u0027t use FALSE_VALUES since I need to check for string value of \u0027False\u0027, not boolean False.","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"},{"author":{"_account_id":14692,"name":"Lucas Fisher","email":"lucas.fisher@gmail.com","username":"lucas.fisher"},"change_message_id":"c418c2318ff8e10c3f4026deda6c9a1c7c657944","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    if (context.call_function_name_qual in function_names):"},{"line_number":27,"context_line":"        if context.get_call_arg_at_position(0).endswith(\u0027password\u0027):"},{"line_number":28,"context_line":"            if context.check_call_arg_value(\u0027secret\u0027) in (None, \u0027False\u0027):"},{"line_number":29,"context_line":"                return(bandit.WARN, \u0027oslo config option not marked secret\u003dTrue\u0027"},{"line_number":30,"context_line":"                       \u0027 identified, security issue.  %s\u0027 %"},{"line_number":31,"context_line":"                       context.call_args_string)"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_3da5e003","line":28,"in_reply_to":"ba7be1f8_efbf155f","updated":"2015-02-25 18:35:52.000000000","message":"Yeah, I need to rethink that.  It should have the AST values instead of the python values.","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"7b932dd54a7f2f7d7d8b86cc6382134b918c2402","unresolved":false,"context_lines":[{"line_number":29,"context_line":"                return(bandit.WARN, \u0027oslo config option not marked secret\u003dTrue\u0027"},{"line_number":30,"context_line":"                       \u0027 identified, security issue.  %s\u0027 %"},{"line_number":31,"context_line":"                       context.call_args_string)"},{"line_number":32,"context_line":"            elif context.check_call_arg_value(\u0027secret\u0027) !\u003d \u0027True\u0027:"},{"line_number":33,"context_line":"                return(bandit.INFO, \u0027oslo config option possibly not marked\u0027"},{"line_number":34,"context_line":"                       \u0027 secret\u003dTrue identified.  %s\u0027 %"},{"line_number":35,"context_line":"                       context.call_args_string)"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_943f8cb3","line":32,"updated":"2015-02-25 16:34:29.000000000","message":"This conditional checks whether secret is not True, for example when its set to a variable, secret\u003dsecret.","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"}],"examples/secret-config-option.py":[{"author":{"_account_id":14692,"name":"Lucas Fisher","email":"lucas.fisher@gmail.com","username":"lucas.fisher"},"change_message_id":"28ac135aa644ac7c33512d12c62af693c603fad7","unresolved":false,"context_lines":[{"line_number":20,"context_line":"               help\u003d\"LDAP ubind ser name\"),"},{"line_number":21,"context_line":"    cfg.StrOpt(\u0027ldap_password\u0027,"},{"line_number":22,"context_line":"               help\u003d\"LDAP bind user password\"),"},{"line_number":23,"context_line":"    cfg.StrOpt(\u0027ldap_password_attribute\u0027,"},{"line_number":24,"context_line":"               help\u003d\"LDAP password attribute (default userPassword\"),"},{"line_number":25,"context_line":"    cfg.StrOpt(\u0027user_password\u0027,"},{"line_number":26,"context_line":"               secret\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_86892d77","line":23,"updated":"2015-02-25 14:16:53.000000000","message":"Good. You put in a test case where password is in middle and not a password value. I was wondering if there were cases like this.","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"7b932dd54a7f2f7d7d8b86cc6382134b918c2402","unresolved":false,"context_lines":[{"line_number":20,"context_line":"               help\u003d\"LDAP ubind ser name\"),"},{"line_number":21,"context_line":"    cfg.StrOpt(\u0027ldap_password\u0027,"},{"line_number":22,"context_line":"               help\u003d\"LDAP bind user password\"),"},{"line_number":23,"context_line":"    cfg.StrOpt(\u0027ldap_password_attribute\u0027,"},{"line_number":24,"context_line":"               help\u003d\"LDAP password attribute (default userPassword\"),"},{"line_number":25,"context_line":"    cfg.StrOpt(\u0027user_password\u0027,"},{"line_number":26,"context_line":"               secret\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba7be1f8_941eac0a","line":23,"in_reply_to":"ba7be1f8_86892d77","updated":"2015-02-25 16:34:29.000000000","message":"Done","commit_id":"ccf02a1eec8115cdd453e8a261cf45ebccaadf3d"}]}